Topi Miettinen <toiwoton@xxxxxxxxx> wrote: > Note that the kernel may accept expressions without errors even if it > doesn't implement the feature. For example, input chain filters using > *meta skuid*, *meta skgid*, *meta cgroup* or *socket cgroupv2* > expressions are silently accepted but they don't work yet, except when used > with *tproxy* rules, early demultiplexing or BPF programs. This is what iptables-extensions(8) says: IMPORTANT: when being used in the INPUT chain, the cgroup matcher is currently only of limited functionality, meaning it will only match on packets that are processed for local sockets through early socket demuxing. Therefore, general usage on the INPUT chain is not advised unless the implications are well understood. For nftables, this is true for all meta types that use skb->sk internally, such as skuid, skgid, cgroup, ... > Could you please explain this 'early demux' concept? Is this something that > can be triggered with NFT rules, kernel configuration etc? I can't find any > documentation. sysctl. net.ipv4.ip_early_demux = 1 net.ipv4.tcp_early_demux = 1 net.ipv4.udp_early_demux = 1 This is a performance optimization, tcp edemux only works for sockets in established state, udp demux has restrictions as well. So, no guarantee that this will set the socket reliably, hence the paragraph in the iptables-extensions manpage.
